Root

All tinkering should start with a full system backup. It is essential to backup
all the photos, your won’t have a second chance to take photos of your kids in two years
old.

Then you need to enable the Developer Mode for ADB debugging, so we can put packages to
the internal storage. Also we need to install the [LG Driver] to communicate the phone via
the USB serial protocol used by the Send_Command.exe later.

Download and unzip the [LG Root package], and open a command prompt from there.
The first adb session requires your confirmation on the device to consent, and you should
see the attached device like this:

I could not find the secret sauce of the magic Send_Command, but the [Unix port] shed some
lights on it: it opens the serial port, COM3 in our case, and then writes the command to the
stream with crafted packing, — I assume this may exploit the vulnerability to gain the root
access?

Within the command prompt, we grant the SuperSU root privilege and launch it when booting up:

After the command is done, you have to disconnect the USB cable, pull the battery out and back to restart
the phone.

TWRP recovery

[TeamWinTWRP][twrp] is a powerful utility to boot the phone into the recover mode with root access
to the system partition; more or less like the Linux LiveCD. See the original [README][twrp readme]
for more details.

Download and unzip the latest version, 3.0.2.0 for the time writing.
Copy the recovery.img to the SD card, and
in the adb shell session: